Gradually the Linux kernel has evolved and doing quite more complex work to modify it to those ends, so currently the most effective way to install a rootkit on a Linux system is to go towards the 'userland'

This kind of rootkits there are two types , or which change the typical binary system associated information (ps and friends) and more sophisticated rootkits inject a library in the process.

Have long existed rootkits acting that way, but had remained somewhat hidden, relatively recently has released a fully functional implementation of a rootkit capable of infecting a Linux system today, his name: Jynx

This type of rootkits act injecting a shared library (. So) in all system processes.

Authored by ErrProneJynx Kit is a LD_PRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell. Solid building block for further LD_PRELOAD rootkits.

Gradually the Linux kernel has evolved and doing quite more complex work to modify it to those ends, so currently the most effective way to install a rootkit on a Linux system is to go towards the 'userland'

This kind of rootkits there are two types , or which change the typical binary system associated information (ps and friends) and more sophisticated rootkits inject a library in the process.

Have long existed rootkits acting that way, but had remained somewhat hidden, relatively recently has released a fully functional implementation of a rootkit capable of infecting a Linux system today, his name: Jynx

This type of rootkits act injecting a shared library (. So) in all system processes.

Authored by ErrProneJynx Kit is a LD_PRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell. Solid building block for further LD_PRELOAD rootkits.

Gradually the Linux kernel has evolved and doing quite more complex work to modify it to those ends, so currently the most effective way to install a rootkit on a Linux system is to go towards the 'userland'

This kind of rootkits there are two types , or which change the typical binary system associated information (ps and friends) and more sophisticated rootkits inject a library in the process.

Have long existed rootkits acting that way, but had remained somewhat hidden, relatively recently has released a fully functional implementation of a rootkit capable of infecting a Linux system today, his name: Jynx

This type of rootkits act injecting a shared library (. So) in all system processes.

Authored by ErrProneJynx Kit is a LD_PRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell. Solid building block for further LD_PRELOAD rootkits.

Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executableWarning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executableWarning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script text executableWarning: The command '/bin/which' has been replaced by a script: /bin/which: POSIX shell script text executable

Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executableWarning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executableWarning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script text executableWarning: The command '/bin/which' has been replaced by a script: /bin/which: POSIX shell script text executable

While I don't want to stop anybody from doing whatever they want because they assume something is wrong, it would be a good idea to invest a little time into research, since that is faster and more reliable than blindly formatting, especially since rkhunter generates false positives too.

Yes, I have been able to see the scripts which appear to be legitimate, therefore, must be false positives from RKH.I'm now back to where I was before I downloaded, installed and misconfigured RKH. I'll poke around with a manufactured Live CD some and try to discover what the fuzz.

Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executableWarning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executableWarning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script text executableWarning: The command '/bin/which' has been replaced by a script: /bin/which: POSIX shell script text executable

Something not correct is occuring, my auto updater, Ubuntu 11.04 64bit, is asking me to update a language pack, I don't have Firefox, and Firefox isn't present on the entire network.

Quote

EvilGrade is a framework which the exploits weaknesses in the auto-update services of multiple common software packages and the attack performed by this framework is one of the best example for client exploitation. This framework tricks the service into believing there is a signed update available for the product, thus prompting the user to install the upgrade where the upgrade is the attacker’s payload. This type of attack is a bit difficult for a normal user to detect since they don’t see anything suspicious and the upgrade looks legitimate.

We can use this framework with the combination of DNS spoofing or Man-in-the-middle attack in order to spoof the software upgrade. This therefore tricks the victim into downloading the upgrade, thereby executing our malicious arbitrary code.

Evilgrade takes the advantage of various applications because most of these verify neither the update contents nor the master update server. Basically, in this type of attack, the attacker seeks to modify the DNS traffic of the victim and return them to some other ip address controlled by the attacker.

If Firefox had been installed, and the update appearing to be legitimate, Ubuntu's 'update-notifier' application, I would have clicked it, even though it was only a language pack available for update. It's also entirely possible I already installed some malware because of this EvilGrade method.

How can you determine what IP's update-notifier is providing the update from?Is it possible to force the sources.list addresses to use a host file instead of DNS?Can tzdata be removed from Ubuntu without breaking it's ability to function?

If Firefox had been installed, and the update appearing to be legitimate, Ubuntu's 'update-notifier' application, I would have clicked it, even though it was only a language pack available for update. It's also entirely possible I already installed some malware because of this EvilGrade method.

How can you determine what IP's update-notifier is providing the update from?Is it possible to force the sources.list addresses to use a host file instead of DNS?Can tzdata be removed from Ubuntu without breaking it's ability to function?

If you put at least one of those questions on Rugatu you will really make some bitcoiners happy

Is it possible to force the sources.list addresses to use a host file instead of DNS?

I'm pretty sure the hosts file is always prefered over the network's DNS server anyway, though this probably can't be relied upon if you suspect a rootkit. You can, however, put the repo's IP address directly in the sources.list file, eg:

Is it possible to force the sources.list addresses to use a host file instead of DNS?

I'm pretty sure the hosts file is always prefered over the network's DNS server anyway, though this probably can't be relied upon if you suspect a rootkit. You can, however, put the repo's IP address directly in the sources.list file, eg:

Code:

deb ftp://130.89.148.12/debian/ squeeze main contrib non-free

(though this also shouldn't be relied upon if you've got a rootkit)

Then I will do this when/if I reinstall the OS, I want to gather more details first though before I nuke stuff.

Can tzdata be removed from Ubuntu without breaking it's ability to function?

No. What's tzdata got to do with anything anyway?

tzdata, is one of a small list of programs that is allowed complete internet access through all IDS and firewalls.I had strange behavior appear, after wipe and reinstalls, only after the very first internet connection, which seemed to affect, gnome, network-manager and screensaver, (affected in that order). My internal domain would change to a blackberry ID. No internet connectivity after installation and gnome, network-manager, screensaver did not wig out and the internal domain name did not change. Because of this, I thought the possible infection is occurring through some first connect event, DNS or first outbound connecting program after the network is up. I eliminated ntpd and bluez before first connect and the issues still occurred. Outside of tzdata and DNS I'm not aware of what else could be contributing to this behavior.

tzdata, is one of a small list of programs that is allowed complete internet access through all IDS and firewalls.

What are you talking about? tzdata is a collection of data files (as the name suggests), and contains no programs. The only executable file related to it (tzconfig) is actually just a shell script consisting entirely of an echo command displaying installation instructions. Nothing related to tzdata should be accessing the network in any way, and you can safely delete any executable files related to it.

tzdata, is one of a small list of programs that is allowed complete internet access through all IDS and firewalls.

What are you talking about? tzdata is a collection of data files (as the name suggests), and contains no programs. The only executable file related to it (tzconfig) is actually just a shell script consisting entirely of an echo command displaying installation instructions. Nothing related to tzdata should be accessing the network in any way, and you can safely delete any executable files related to it.

Well then, I must have misunderstood the Ubuntu help code boxes that show tzdata collecting local and utc time, assuming it had network functions. Since I don't need to put anymore time and effort into tzdata I can focus on more probable targets.

pcap:Will pcap files gathered from/on a system that may be infected provide useful data?I don't have a switch that can do port mirroring so what methods would help me to overcome this limitation?